altered auth: index is available to all, show is for signed-in only